At decommissioning, AI systems follow the organization's regular offboarding process. Access and accounts are removed, and the AI register is updated.
Baseline
Applies to every organization that uses AI, regardless of size or sector.
Why
AI systems connected to internal mailboxes, calendars or file stores may retain their access after trials or subscriptions expire, presenting an access risk. Organizational data supplied to the provider may also remain with the provider, unless a deletion request is made.
How
AI system decommissioning should follow the organization's existing offboarding process. After offboarding, the register must be updated. To prevent future training on data if terms change, the organization should request that the provider deletes or returns all organizational data.
Sources
- NIST AI RMF GOVERN 1.7
- NIST AI RMF MANAGE 2.4
- NIST AI RMF MANAGE 4.1